Osan Air Base Data Policy Sparks Privacy Debate

Osan Air Base in Pyeongtaek, South Korea, has become the focal point of a heated debate over the handling of sensitive personal information—specifically, the resident registration numbers of Korean reservists. This issue, reported on January 26, 2026, by The Korea Herald, has triggered concerns about privacy, legal oversight, and the broader implications for South Korea’s alliance with the United States.

The controversy centers on the South Korean Air Force’s Operations Command at Osan Air Base, which, in recent months, has begun collecting full 13-digit resident registration numbers from reservists mobilized for training and submitting them to the US 7th Air Force. Previously, only basic data like names, contact details, and dates of birth were required. The change, as explained by a South Korean Air Force official speaking anonymously to The Korea Herald, stems from US forces’ increased control over base access. “In the past, reservists could enter the base under Korean military escort,” the official said. “But since US forces now manage access control, identity verification standards have changed.”

The resident registration number, akin to the US Social Security number, is a linchpin of Korean identity verification. It encodes birth date, gender, and place of registration, and—when paired with a name—can be used to open bank accounts or secure mobile phone contracts. The sensitivity of this information has made its collection by a foreign military authority a flashpoint for debate.

Under the revised procedures, the Air Force requests this data from the Military Manpower Administration roughly a month before training sessions. The information is then submitted to US forces, who use it to issue base access passes. Internal documents detailing these changes have circulated among military officials, and the process is now in place for approximately six annual training sessions, each involving around 50 reservists.

Once collected, the data is stored in the Defense Biometric Identification System (DBIDS), a US Department of Defense-managed identity and access control system used globally. According to US Forces Korea regulations—specifically USFK Instruction 5200.08—all external visitors’ identities must be registered in DBIDS. However, as The Korea Herald notes, once entered, the data remains in the system even after access ends, making it difficult for Korean citizens to know how long their information is retained, how it is used, or whether it can ever be withdrawn.

The 51st Fighter Wing under the US Seventh Air Force, which oversees Osan’s US facilities, has stated that the system is meant to “enhance gate operations.” US Forces Korea further clarified that the data is used solely for “identity verification purposes,” but declined to provide additional details.

Legal experts and privacy advocates argue that the practice may run afoul of Korean law, which requires that individuals be informed about how their personal data is collected, used, and managed. Consent is a key pillar: individuals must be allowed to define the scope of their consent and request corrections or deletions. Data handlers are also required to collect only the minimum amount of personal information necessary, and to do so in a manner deemed appropriate by law.

Yet, South Korea’s Air Force has not clarified whether it can lawfully provide such sensitive data to a foreign military authority without explicit consent from the individuals concerned. The Military Manpower Administration, for its part, deferred the issue to the Defense Ministry, which responded that it “sets general policy while operational details are handled by each service.”

Hwang Suk-jin, a professor at Dongguk University’s Graduate School of International Information Security, told The Korea Herald that alternative identification methods should be considered. “Resident registration numbers are classified as highly sensitive personal information. Given that such numbers are extremely difficult to change, it would be more prudent to explore alternative identification methods, such as passport numbers, which can be renewed,” Hwang said. He also pointed to the lingering aftereffects of major data breaches at companies like Coupang, Lotte Card, and KT, questioning the wisdom of sharing such sensitive data with foreign authorities without individual consent.

For reservists, the new rules are not a matter of choice. Unlike civilian contractors or voluntary visitors, reservists are mobilized by law and have little say in how their personal information is handled. Those who completed active service at Osan—whether in the Air and Missile Defense Command, the Air Defense Control Command, or the Air Force Operations Command—are typically assigned there for reserve training. Others may be mobilized to Osan based on their specialty or operational requirements, including roles essential to combined South Korea-US military operations.

Changing training locations is no simple matter. The Military Manpower Administration does not allow transfers based on personal preference, and relevant laws permit changes only in exceptional circumstances, such as relocation, illness, or national emergencies. Consequently, concerns about data privacy are unlikely to exempt reservists from attending training under the new regime.

Other joint facilities have taken different approaches. At Gunsan Air Base, another South Korea-US installation, entry procedures for reservist training have reportedly been less stringent. Meanwhile, at Camp Humphreys, where reserve training has been conducted since 2023 for former Korean Augmentation to the US Army soldiers (KATUSA), personal data was already registered during their active service.

The next reserve training session at Osan is scheduled for mid-April 2026, and the enhanced security measures are not expected to impact training schedules or formats. These changes, widely interpreted as part of a broader restructuring of base access, followed a special counsel’s raid at Osan in July 2025. That raid was part of an investigation into former President Yoon Suk Yeol’s December 2024 martial law declaration and alleged drone operations over North Korea. After the special counsel’s team entered Osan via a gate managed by Korean forces, US authorities announced a plan to directly control all entry points, reclaiming authority from South Korean forces.

Under the South Korea-US Status of Forces Agreement, Osan Air Base is classified as a facility provided by South Korea to the United States, granting US forces operational authority over the base. In October, US Seventh Air Force commander Lt. Gen. David Iverson sent a letter of protest to South Korea’s Foreign Ministry regarding the special counsel’s raid, but according to local reports, the letter went unanswered.

The new entry rules, initially set for January, are now expected to take effect from mid-February 2026, after a grace period. In the meantime, Korean and US personnel are jointly stationed at the affected gate.

This debate over data privacy and military authority comes amid broader questions about the future of the South Korea-US alliance. As noted in a Korea JoongAng Daily opinion piece on January 27, 2026, the transition of wartime operational control (Opcon) remains a contentious issue, with parallels drawn to NATO’s own debates over command and deterrence. President Lee Jae Myung has emphasized the importance of self-reliant national defense but cautioned against any moves that might weaken the alliance or diminish US extended deterrence.

As South Korea navigates the delicate balance between national security, alliance obligations, and personal privacy, the controversy at Osan Air Base may prove to be just the tip of the iceberg. The outcome will likely shape not only how sensitive data is managed but also the evolving dynamics of one of the world’s most important military partnerships.